Privacy

This site doesn't track who visits it. There's no analytics, no ad scripts and no cookie banner, because there's nothing to consent to. I mainly handle personal data when you write to me.

Who is responsible

Filip Héda, Tisová 1074, 252 42 Jesenice, Czech Republic, Company ID 22089292. Under the GDPR, I'm the controller of your personal data. You can reach me at [email protected].

When you write to me

From your email I have your name, address, the message itself and anything else you choose to include, such as your company or phone number. I use it only to reply and to agree on a project with you. The legal basis is taking steps at your request before entering into a contract (Art. 6(1)(b) GDPR).

If no project comes of it, I delete the correspondence no later than two years after the last message. If one does, I keep the data for as long as we work together and three years after, in case a claim needs to be settled (legitimate interest, Art. 6(1)(f)). Invoices are kept for ten years, as Czech VAT law requires (Art. 6(1)(c)).

When you just browse

• The site runs on DigitalOcean servers and reaches you through the Cloudflare network. Both see your IP address and browser details when a page loads, because they can't deliver the page or fend off attacks without them. This is a legitimate interest in running the site securely (Art. 6(1)(f)).
• Cloudflare sets a cookie called __cf_bm to tell bots from people. It expires after 30 minutes. The site can't be protected without it, so it doesn't need your consent.
• If you click the language switch, your browser remembers the choice (heda:lang in browser storage). It stays on your device and is never sent anywhere.
• The fonts are stored on this site itself, so visiting it doesn't contact Google or anyone else.

Who else has access

I don't sell your data or pass it on for advertising. The only services that handle it are the ones the site and email run on:

• Google, which runs the Gmail mailbox,
• DigitalOcean, whose servers host the site,
• Cloudflare, which delivers and protects the site.

All three are based in the US. Transfers there are covered by the EU–US Data Privacy Framework, which all three have signed up to.

Your rights

You can ask me for access to your data, to correct or delete it, to restrict how it's used, or to have it transferred elsewhere. You can object to processing based on legitimate interest. Just write to [email protected] and I'll deal with it without undue delay, within a month at the latest.

If you're unhappy with how I handle your data, you can complain to the Czech Office for Personal Data Protection, or to the data protection authority in your own EU country.

Effective from 15 September 2026